lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: security with multi-company

Browse Source
This commit is contained in:
Regis Houssin 2009-05-04 08:42:29 +00:00
parent 825f3346c9
commit 8b02eb1f3f
16 changed files with 64 additions and 144 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
htdocs/product/barcode.php
View File

@ -34,17 +34,12 @@ $langs->load("products");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/document.php
View File

@ -39,17 +39,12 @@ $langs->load("products");
$action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action']) : $_GET['action']; $action=empty($_GET['action']) ? (empty($_POST['action']) ? '' : $_POST['action']) : $_GET['action'];
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/fiche.php
View File

@ -41,17 +41,12 @@ $langs->load("other");
$langs->load("stocks"); $langs->load("stocks");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/fournisseurs.php
View File

@ -36,17 +36,12 @@ $langs->load("suppliers");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/photos.php
View File

@ -35,17 +35,12 @@ $langs->load("products");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/price.php
View File

@ -35,17 +35,12 @@ $langs->load("products");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/sousproduits/fiche.php
View File

@ -36,17 +36,12 @@ $langs->load("bills");
$langs->load("products"); $langs->load("products");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/commande.php
View File

@ -36,17 +36,12 @@ $langs->load("products");
$langs->load("companies"); $langs->load("companies");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/commande_fournisseur.php
View File

@ -36,17 +36,12 @@ $langs->load("products");
$langs->load("companies"); $langs->load("companies");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/contrat.php
View File

@ -35,17 +35,12 @@ $langs->load("products");
$langs->load("companies"); $langs->load("companies");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/facture.php
View File

@ -36,17 +36,12 @@ $langs->load("bills");
$langs->load("products"); $langs->load("products");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/facture_fournisseur.php
View File

@ -37,17 +37,12 @@ $langs->load("products");
$langs->load("companies"); $langs->load("companies");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/fiche.php
View File

@ -39,17 +39,12 @@ $langs->load("other");
$mode=isset($_GET["mode"])?$_GET["mode"]:'byunit'; $mode=isset($_GET["mode"])?$_GET["mode"]:'byunit';
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stats/propal.php
View File

@ -35,17 +35,12 @@ $langs->load("products");
$langs->load("companies"); $langs->load("companies");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/stock/product.php
View File

@ -37,17 +37,12 @@ $langs->load("orders");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);

13
htdocs/product/traduction.php
View File

@ -36,17 +36,12 @@ $langs->load("products");
$langs->load("bills"); $langs->load("bills");
// Security check // Security check
$id = ''; if (isset($_GET["id"]) || isset($_GET["ref"]))
if (isset($_GET["id"]))
{ {
$id = $_GET["id"]; $id = isset($_GET["id"])?$_GET["id"]:(isset($_GET["ref"])?$_GET["ref"]:'');
$fieldid = 'rowid'; $fieldid = isset($_REQUEST["ref"])?'ref':'rowid';
}
if (isset($_GET["ref"]))
{
$id = $_GET["ref"];
$fieldid = 'ref';
} }
if ($user->societe_id) $socid=$user->societe_id; if ($user->societe_id) $socid=$user->societe_id;
$result=restrictedArea($user,'produit',$id,'product','','',$fieldid); $result=restrictedArea($user,'produit',$id,'product','','',$fieldid);